Diego Zamboni's thesis work

My Ph.D. dissertation is called Using Internal Sensors for Computer Intrusion Detection ( PostScript: 1.1MB, PDF: 519KB), and is the basis for the ESP project at CERIAS. Read on for a more detailed description (of course, read the dissertation for the full details).


Most of my research at CERIAS has been in the area of intrusion detection. I worked in the AAFID project, which showed the feasibility of using small independent components (called "autonomous agents" in AAFID) for performing intrusion detection.

However, AAFID also exposed some of the problems of the approach. One particularly limiting problem, shared by virtually every existing intrusion detection system, is that of using separate processes for the intrusion detection components. The use of separate processes means that the intrusion detection sytem imposes a constant overhead on the systems where the components are running (because of the overhead caused by the extra process(es)), that it is vulnerable to tampering or disabling by an attacker (if he manages to kill or otherwise disable the intrusion detection processes) and in some cases, that is scalability is limited (in the current implementation of AAFID each agent is implemented as a separate process, which limits the maximum number of agents that can be running on a single host).

This caused my work to shift towards lower-level components, which I now call internal sensors and embedded detectors. Briefly, they are defined as follows:

Internal sensor:
A piece of software (potentially aided by a hardware component) that monitors a specific variable, activity or condition of a program and that is an integral part of the program being monitored.

Embedded detector:
An internal sensor that has added logic for detecting conditions that indicate a specific attack or intrusion.

Internal sensors and embedded detectors have a number of advantages, including:

They also have some disadvantages, mainly that their implementation is completely dependent on the program in which they are implemented.

My research

My thesis research is on showing that it is possible to build an intrusion detection system based on internal sensors and embedded detectors, on investigating the characteristics and limitations of such a system, and on the possibility that such a system could be used to detect new attacks without the need to constantly implement new sensors and detectors.

The ESP project

My thesis research is the base for the ESP project at CERIAS. ESP stands for "Embedded Sensors Project", because it was named before I developed the concept of embedded detectors as a different thing from internal sensors.

The ESP project is currently working in the implementation of sensors and detectors for a number of different attacks and intrusions, using OpenBSD as an implementation platform. We are also using this project as a platform for some other research ideas based on the concept of internal sensors.

We have currently around 50 detectors implemented. My goal is to reach approximately 100 detectors for the purposes of analysis in my thesis.



If you have any question, comments, or simply want to talk about this work, feel free to drop me an email.

Diego Zamboni
Last modified: Tue Feb 20 20:49:22 EST 2001
Back to my home page